The Listdom: AI‑powered Business Directory with Classifieds Ads Listings plugin for WordPress allows an authenticated user with contributor‑level or higher access to store arbitrary web scripts in the listing remark field. When a page containing the injected remark is viewed, the malicious script executes in the victim’s browser, potentially allowing session hijacking, defacement or data theft. The flaw stems from insufficient input sanitization and a lack of proper output escaping, as documented in the plugin’s source code.

Any WordPress site that has installed the Listdom plugin version 6.1.1 or earlier. The vulnerability applies to all releases up to and including 6.1.1, regardless of other plugins or themes, and is identified as affecting the webilia Listdom product on WordPress.

The CVSS score of 6.4 indicates a medium severity risk. The EPSS score is not available, but the flaw is noted as not being listed in the CISA KEV catalog. The exploit requires an authenticated session in WordPress, yet the vulnerable AJAX handler lacks a capability check, enabling subscription‑level users to inject payloads if the [listdom-dashboard] shortcode exposes a public nonce. Consequently, the overall risk is moderate‑high, with attackers capable of deploying XSS that will run for any user that views affected pages.